Cybersecurity Today

Daniel Berulis, a whistleblower who exposed tenant admin abuse in a government cloud environment, shares his harrowing journey of disclosing unauthorized data copying and audit trail wiping to Congress. He details the alarming red flags he noticed, his attempts to escalate the issue, and the emotional turmoil of choosing to speak up. The discussion highlights the complexities faced by whistleblowers, the importance of ethical transparency, and the vital role of robust cybersecurity measures in protecting sensitive information.

Delve into alarming cybersecurity breaches that reveal serious vulnerabilities. Discover how a security flaw in Microsoft OneDrive can compromise user data, and the fallout from PowerSchool's ransomware incident affecting students. Learn about a DOGE staffer's malware breach that raises questions about employee access and accountability. The discussion underscores the critical need for stronger security measures in both the private sector and government agencies, stressing the dangers of neglecting proper oversight.

In this episode of Cybersecurity Today, host Jim Love delves into a range of alarming cyber incidents. A six-year sleeper supply chain attack has compromised thousands of e-commerce websites, exploiting vulnerabilities in Magento extensions from vendors Tigren, Meetanshi, and Magesolution. Russian-controlled open-source tool Easy JSON raises scrutiny over potential threats in critical sectors like defense and finance. In Ontario, a sophisticated bank draft scam costs a business $108,000, emphasizing the need for verification processes. Additionally, a messaging tool used by the Trump administration to archive Signal messages has been hacked twice, highlighting serious concerns over the security of high-level US communications. Stay tuned for the latest insights and expert advice on maintaining cybersecurity. 00:00 Sleeper Supply Chain Attack Activates After Six Years 02:19 Russian Controlled Open Source Tool Raises Alarms 04:32 Fake Bank Draft Fools the Bank 05:56 Signal Archiving Tool Breached 08:33 Conclusion and Contact Information

Cybersecurity Today: Disney Data Theft, Signal Gate, and Major Apple Vulnerability In this episode of Cybersecurity Today, host David Shipley discusses several key security incidents. Hacker 'Null Bulge,' real name Ryan Kramer, pleads guilty to stealing over 1.1 TB of data from Disney's Slack via malware disguised as an AI image generation tool. Additionally, former National Security Advisor Mike Waltz's use of a compromised Signal app 'TM Signal' is explored, highlighting significant security flaws. The episode also covers critical vulnerabilities in Apple AirPlay-enabled devices that allow malicious code execution via Wi-Fi and reveals that an employee benefits administration provider breach has impacted 4 million Americans, significantly more than originally reported. 00:00 Introduction and Headlines 00:34 Disney's Slack Data Breach 02:00 Security Flaws in TM Signal App 03:18 Apple AirPlay Vulnerabilities 04:54 Massive Data Breach at Vari Source Services 06:59 Conclusion and Contact Information

In this episode of Cybersecurity Today, host Jim Love is joined by roving correspondent David Shipley to discuss his experiences at the BSides and RSAC conferences. They dive into the significant takeaways from BSides, including highlights from notable presentations such as Truffle Hog's AI Apocalypse and Eva Galperin's talk on the 'World's Dumbest Cyber Mercenaries'. They also explore emerging trends in AI, deepfake technology, and the human side of cybersecurity. The discussion shifts to RSAC, examining vendor presence, CrowdStrike's gamified approach to engagement, and the broader implications of cybersecurity costs and industry consolidation. The episode underscores the importance of ongoing education, responsible cybersecurity practices, and the need for clear communication in the industry. 00:00 Introduction and Guest Introduction 01:24 BSides Conference Overview 03:55 Key Highlights from BSides 04:31 AI Apocalypse and Security Concerns 11:21 World's Dumbest Cyber Mercenaries 15:57 Deepfake Technology and Countermeasures 22:45 RSAC Conference Overview 28:48 Experiencing Autonomous Cars in San Francisco 30:00 The Future of High-Tech Mobility Solutions 32:22 AI in Cybersecurity: Implications and Discussions 37:26 The Role of AI in Coding and Its Challenges 40:34 Chris Krebs and the Importance of Speaking Truth to Power 44:36 Human Side of Cybersecurity: Security Champions 46:49 Operation Shamrock: Tackling Pig Butchering Scams 51:47 CrowdStrike and Vendor Strategies at Conferences 53:16 The Cost of Cybersecurity and Industry Consolidation 54:46 Conclusion and Future Interviews

In this episode, host Jim Love discusses various cybersecurity topics including a book deal from CRC Press for those interested in cybersecurity, auditing, and leadership. Major cyber incidents involving two UK retailers, Co-op and Marks & Spencer's, are detailed, highlighting the challenges they face. Apple's notifications to users in 100 countries about targeted mercenary spyware attacks are covered, emphasizing the importance of taking these alerts seriously. Additionally, a malicious WordPress plugin has been discovered that grants attackers unauthorized access, and an open letter from cybersecurity professionals calls on President Donald Trump to cease investigations into former CISA Director Chris Krebs. The episode concludes by previewing an upcoming segment covering the B Side and RSA shows. 00:00 Introduction and Special Announcement 00:16 Cybersecurity Book Deals 01:37 Major Cyber Attacks on UK Retailers 03:48 Apple's Spyware Alerts 06:22 Malicious WordPress Plugin Discovered 08:19 Open Letter Supporting Chris Krebs 10:57 Conclusion and Upcoming Events

  In this episode of Cybersecurity Today, host Jim Love discusses several major cybersecurity events. Two members of Elon Musk's 'Department of Government Efficiency' reportedly gained access to classified US nuclear networks, though accounts were never activated. Nova Scotia Power faces a cyber attack affecting customer services but not critical infrastructure. Additionally, over 1.7 billion stolen credentials have surfaced on the dark web, primarily collected via info stealer malware, emphasizing the growing threat to corporate security. Lastly, the importance of advancing beyond traditional password security is highlighted on World Password Day. For more information, tune in to the episode or reach out via email or LinkedIn. 00:00 Introduction and Headlines 00:22 Musk's Doge Staffers and US Nuclear Networks 03:16 Nova Scotia Power Cybersecurity Incident 05:19 Massive Data Breach on World Password Day 07:56 Conclusion and Contact Information

In this episode of 'Cybersecurity Today', host David Shipley covers multiple key stories: Veritaco CEO Jeffrey Bowie is charged with attempting to infect a hospital with malware. Global Chief Information Security Officers (CISOs) call on world governments to harmonize cybersecurity regulations. Issues arise with Microsoft's recent 'Mystery Folder' security patch. Highlights from B-Side San Francisco's AI discussions include talks on weaponizing large language models and detecting deep fake technology. Additionally, the RSA Conference kicks off, promising numerous vendor announcements and updates. 00:00 Cybersecurity CEO Charged with Hospital Malware Attack 01:56 Global CISOs Call for Unified Cyber Regulations 03:59 Microsoft's Mystery Folder Fix Issues 05:37 AI Talks at B-Side San Francisco 08:08 RSA Conference Highlights and Conclusion

In this episode of Cybersecurity Today, host Jim Love delves into the topic of SaaS (Software as a Service) security. Sharing his early experiences promoting SaaS, Jim elaborates on its inevitable rise due to cost-effectiveness and shared development resources. The episode highlights security concerns with SaaS, such as shadow IT and weak access control, especially in the face of an influx of AI software. Jim introduces Yoni Shohet, CEO and Co-founder of Valence Security, who discusses the SaaS security landscape, focusing on the independent 'State of SaaS Security' report by the Cloud Security Alliance. Yoni outlines the importance of monitoring API tokens, ensuring proper configurations, and the challenges posed by non-human identities. The discussion underscores the evolving nature of SaaS security, encouraging stronger collaboration between security teams and business units to manage risks effectively. 00:00 Introduction to SaaS Security 00:01 The Evolution and Benefits of SaaS 01:33 Challenges and Security Concerns with SaaS 02:08 Introduction to the State of SaaS Security Report 02:34 Interview with Yoni Shohet: Background and Experience 03:06 Yoni Shohet's Journey in Cybersecurity 08:33 The Rise of SaaS Security Issues 14:03 Key Findings from the SaaS Security Report 17:32 The Importance of SaaS Security Measures 21:36 Managing SaaS Security in Organizations 33:43 Valence Security's Approach to SaaS Security 36:59 Conclusion and Final Thoughts

Cybercrime losses hit a staggering $16.6 billion in 2024, showcasing a 33% spike from the previous year. Elder adults face a higher threat from phishing, spoofing, and investment fraud. A significant data breach at Blue Shield of California impacted 4.7 million members due to a misconfigured Google Analytics. Global ransomware trends reveal that 86% of affected firms paid ransoms, impacting nearly half of all cyber incidents. The discussion also highlights the benefits of phishing training and previews upcoming cybersecurity events.